ci(vscode): publish the extension to the Marketplace on difit releases

[yoshiko-pg]

What

Adds .github/workflows/publish-vscode.yml, triggered when a GitHub release is published (the same trigger as the npm publish workflow) plus workflow_dispatch for manual runs:

1. Version sync — rewrites packages/vscode/package.json version to the released difit version, so the extension version always matches the CLI it bundles. The in-repo 0.1.0 stays as a placeholder.
2. Build & package — reuses the existing pnpm run package:vscode script (root build → esbuild bundles → watcher prebuilds → vsce package).
3. Publish (no PAT) — uses secure automated publishing to Visual Studio Marketplace: the job's release environment exchanges a GitHub OIDC token for a Microsoft Entra ID credential via azure/login (workload identity federation), then runs vsce publish --azure-credential. No long-lived Marketplace PAT is stored — relevant because Azure DevOps global PATs retire on 2026-12-01. Also publishes to Open VSX when an OVSX_PAT secret exists (Open VSX has no OIDC flow; step is skipped otherwise).
4. Release asset — attaches the .vsix to the GitHub release for manual installs.

Also removes the manual vscode-release Codex skill, superseded by this workflow.

One-time setup required before this works

1. In Azure, create a user-assigned managed identity (or an Entra app registration) and add a federated credential for GitHub Actions with subject repo:yoshiko-pg/difit:environment:release (issuer https://token.actions.githubusercontent.com).
2. In Marketplace publisher management, add that identity as a member of the yoshiko-pg publisher.
3. Add repository secrets: AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_SUBSCRIPTION_ID (identifiers of the identity above).

The release environment is created automatically on the first run; optionally add protection rules to it.

Notes

• The workflow can be tested without a release via Run workflow (workflow_dispatch); it publishes the current main as-is, so run it once after the Azure setup to do the initial Marketplace publish.
• Marketplace rejects re-publishing an existing version, so re-running the workflow for the same release fails cleanly rather than double-publishing.

🤖 Generated with Claude Code